e8cdf30233028ce8877e6352c89411b1_JaffaCakes118 | Triage

Sharing

General

Target

e8cdf30233028ce8877e6352c89411b1_JaffaCakes118
Size

144KB
MD5

e8cdf30233028ce8877e6352c89411b1
SHA1

5b5a3e88b05fefe3f8a66c1b39acb5b54cfb8ca2
SHA256

c5a3c06a1ba939040616ed00baaa52590c122788e27014146af1f41a43a2fa9d
SHA512

ebc4e8c928621f239db1f6b6fa8ef414172845764efd66952058f6320b37d229f7d84de30da7cb196ab4636c8ef91e186d882bfd6873ba90a8e11a1918399195
SSDEEP

3072:4pMyREddQErq7NAe5bDFWgyli61HroynoFBI8M5eGMjyUb:4pMyodQErqJBxJqi6JoFq8M5eGEys

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8cdf30233028ce8877e6352c89411b1_JaffaCakes118

Files

e8cdf30233028ce8877e6352c89411b1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6c322961e8eff4d07998b7129250e75b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GlobalFree
ExitProcess
GlobalAlloc
GetModuleHandleA
Sleep
FreeLibrary
GetProcAddress
GetStartupInfoA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

msvcrt

malloc
strlen
memset
strcmp
strcpy
realloc
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strstr

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ